VeritableValor/invidious
1
0
Fork 0
mirror of https://github.com/iv-org/invidious.git synced 2026-09-06 00:52:45 -05:00
Code Issues Packages Projects Releases Wiki Activity

Gate the SSO password waiver on password_self_service

Browse Source 
The waiver that lets a trusted-header session set a password without the
current one was unconditional. It is the right default — those accounts
were provisioned with a random password nobody ever saw — but an admin
who wants the current password from everybody had no way to say so.

Both call sites now go through TrustedHeaderAuth.password_self_service?,
which folds the flag into the identity check.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
NeskireDK 2026-08-13 06:18:56 +02:00
parent c0a6587d52
commit fae22d037e
2 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/invidious/routes/account.cr
View File

@ -23,7 +23,7 @@ module Invidious::Routes::Account
sid = sid.as(String)
csrf_token = generate_response(sid, {":change_password"}, HMAC_KEY)
sso_verified = Invidious::TrustedHeaderAuth.asserted_email(env) == user.email
sso_verified = Invidious::TrustedHeaderAuth.password_self_service?(env, user)
templated "user/change_password"
end
@ -52,8 +52,9 @@ module Invidious::Routes::Account
# An SSO session proves the identity through the trusted header already, so
# the current password is waived. Accounts provisioned by SSO were given a
# random password the user never saw and could never type here.
sso_verified = Invidious::TrustedHeaderAuth.asserted_email(env) == user.email
# random password the user never saw and could never type here. The waiver
# is off when the admin turned password_self_service off.
sso_verified = Invidious::TrustedHeaderAuth.password_self_service?(env, user)
password = env.params.body["password"]?
if !sso_verified && (password.nil? || password.empty?)

13
src/invidious/trusted_header_auth.cr
View File

@ -45,6 +45,19 @@ module Invidious::TrustedHeaderAuth
email
end
# Whether `user` may change their password without typing the current one.
#
# The header has to assert this very user on this very request, so a
# password-login session never qualifies. The admin can switch the waiver
# off with trusted_header_auth.password_self_service.
def password_self_service?(env, user) : Bool
Invidious::ArikSettings.password_self_service?(
CONFIG.trusted_header_auth.password_self_service,
asserted_email(env),
user.email
)
end
# Return a session id for `email`. Reuses `sid` when that session already
# belongs to the user; otherwise provisions account + session and sets the
# SID cookie, mirroring the manual login flow (routes/login.cr).